Security
Active sessions, the network allowlist, and the recent activity worth an admin's attention.
Settings, Security gathers three things an admin needs to check on. All of it is admin only.
Active sessions
Every live sign-in across the workspace's members, newest first. Each row shows the member, the device the session was created from, when it was created and when it expires.
Expired and revoked sessions are hidden by default, and can be included when you want them.
Revoke ends one session immediately. That browser has to sign in again. Use it for a lost laptop or a session nobody recognises. It affects only the session you picked, and the revocation is written to the audit log.
Removing somebody from the workspace revokes their sessions as well. See Members and roles.
The network allowlist
A list of CIDR ranges recorded against the workspace. The default state is an empty list.
Saving is a replace, not an append. The list you send becomes the whole list, and sending an empty list clears it. Every entry is validated as a CIDR before anything is written, so one bad entry refuses the whole request and leaves the stored list untouched. There is a limit of 64 entries.
Every change is written to the audit log with the list before and after.
The allowlist is recorded, not enforced
Nothing in the runtime today refuses a request for coming from outside these ranges. Saving ranges here stores them and audits the change. Do not treat this as a network control that is in force. If you need one now, put it in front of the deployment.
Recent security events
A fixed set of high-risk actions, newest first: API keys created, revoked or deleted, members removed or changed, MCP access revoked or restored, invitations issued, resent or revoked, sessions revoked, allowlist changes, plan changes and provider key updates.
It is a filtered view of the audit log rather than a second log, so everything here also appears there. There is no paging and no filter on this view. It returns up to 100 entries and defaults to 20. For anything else, search the audit log.
Credentials worth reviewing here too
The security screen does not list API keys. Review those on their own screen, where the last-used column is the fastest way to spot a key nobody is using. See API keys.